[ CVE-2026-108735 · Published 11 Oct 2026 ]
Vulnerability in miniflux
CVSS 4.3
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/miniflux/v2
- github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/reader/fe…
- github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/urllib/ur…
- hackmd.io/@haind03/miniflux-feed-proxy-url-private-network-bypass
- www.vulncheck.com/advisories/miniflux-2.3.0-through-2.3.3-ssrf-via-per-feed-proxy-url